Linux SECURITY: Linux ACL experience (1)

As security management becomes increasingly important, the UGO permission management method of traditional Unix file systems cannot meet the needs of daily system management. The ACL mechanism has gradually become the mainstream permission management method. This article describes some experiments on the basic ACL functions of ora Core, a release version based on Linux2.6 kernel.
ACL Overview
User permission management is always the most important part in Unix system management. You must be familiar with the UGO permission management methods of Linux/Unix, as well as the most common chmod commands. In order to implement some complicated permission management, you often have to create many groups and record and distinguish them in detail. This is often the nightmare of administrators ). You can specify a permission for a file for a user. I am afraid the Administrator will expect this function. For example, user A can read A specific file, and user B's group can be modified, but user B cannot ....... So we have the ieee posix 1003.1e ACL standard. The so-called ACL is the Access Control List, an Access Control List of files/directories. You can assign RWX permissions to any specified users/groups. Currently, mainstream commercial Unix Systems Support ACL. FreeBSD also supports ACL. Linux will not lag behind in this aspect. The 2.6 kernel supports ACL.
Preparations
The support for ACL requires support from the kernel and file system. Currently, the 2.6 kernel can support ACL in combination with EXT2/EXT3, JFS, XFS, ReiserFS, and other file systems. It is always unwise to use physical partitions used by the user to experience the ACL. In case of damage to the partition caused by misoperations, the loss of data will increase. Making a loop device is a safe alternative. In this way, there is no need for a separate partition or a large hard disk space. About a few hundred KB is enough for our experience. OK. Now I will use the Fedora Core 5 and Ext3 files to start the Linux ACL experience.
First, create a kb blank file:

[root@FC3-vm opt]# dd if=/dev/zero of=/opt/testptn count=512512+0 records in512+0 records out

Associated with a loop device:

[root@FC3-vm opt]# losetup /dev/loop0 /opt/testptn

Create an EXT2 File System:

[root@FC3-vm opt]# mke2fs /dev/loop0mke2fs 1.35 (28-Feb-2004)max_blocks 262144, rsv_groups = 32, rsv_gdb = 0Filesystem label=OS type: LinuxBlock size=1024 (log=0)Fragment size=1024 (log=0)32 inodes, 256 blocks12 blocks (4.69%) reserved for the super userFirst data block=11 block group8192 blocks per group, 8192 fragments per group32 inodes per groupWriting inode tables: doneWriting superblocks and filesystem accounting information: doneThis filesystem will be automatically checked every 30 mounts or180 days, whichever comes first. Use tune2fs -c or -i to override.

Mount the new file system. Pay attention to the acl flag in the mount option. We rely on it to notify the kernel that we need to use the ACL in this file system ):

[root@FC3-vm opt]# mount -o rw,acl /dev/loop0 /mnt[root@FC3-vm opt]# cd /mnt[root@FC3-vm mnt]# lslost+found

Now I have a small file system. In addition, ACL is supported. And even if it is completely damaged, it will not affect other valuable data on the hard disk. Now we can start our ACL experience.